{"schemaVersion":3,"id":"CVE-2018-0460","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation checks. An attacker could exploit this vulnerability by sending a malicious API request with the authentication credentials of a low-privileged user. A successful exploit could allow the attacker to read any file on the affected system.","dates":{"published":"2018-10-05T14:00:00.000Z","modified":"2024-11-26T14:39:53.930Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:S/C:C/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:C/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01895,"percentile":0.79313,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01895},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01699,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01895,"percentile":0.79313}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01699,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01895,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01895,"percentile":0.79313}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-285","name":"Improper Authorization","description":"The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/285.html"},{"id":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/863.html"}],"affected":[{"vendor":"cisco","product":"cisco enterprise nfv infrastructure software","name":"Cisco Enterprise NFV Infrastructure Software","label":"cisco enterprise nfv infrastructure software","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"n/a","noFixRecorded":false,"fixedIn":null}],"versionsText":"n/a","eol":null,"hubHref":"/vendor/cisco/cisco_enterprise_nfv_infrastructure_software"},{"vendor":"cisco","product":"network_functions_virtualization_infrastructure","name":"network functions virtualization infrastructure","label":"network_functions_virtualization_infrastructure","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/network_functions_virtualization_infrastructure"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/105299","label":"www.securityfocus.com/bid/105299","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-nfvis-infodis","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-nfvis-infodis","hostname":"tools.cisco.com","tags":["Vendor Advisory","X Refsource CISCO"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-10-05T14:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-11-26T14:39:53.930Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:18:57.952Z","stale":false,"partial":false}}